topic Re: Splunk ignores date time range after a few queries in Getting Data In

Splunk ignores date time range after a few queries

enverb — Wed, 12 Jun 2019 09:38:56 GMT

I've been having this weird problem where Splunk suddenly starts to ignore the date-time ranges I enter after executing a few queries.

At first, I can search fine and changing the date time works perfectly. Then after X number of search queries, I suddenly get the message "Waiting for queued job to start. Manage jobs."

When I go to the jobs page, I can see the exact query that I entered but what I also notice is that the date time range says "[01/01/1970 00:00:00.000 to 01/01/1970 01:00:00.000]".

If I then go on and kill the job and change the date and time, I get the exact same problem; I can never seem to change the date range from "[01/01/1970 00:00:00.000 to 01/01/1970 01:00:00.000]" to the range I want.

Any ideas?

Re: Splunk ignores date time range after a few queries

kmaron — Thu, 13 Jun 2019 12:44:31 GMT

If you wait for the job to run, instead of killing it, does it run with the correct time range?

Re: Splunk ignores date time range after a few queries

enverb — Thu, 13 Jun 2019 14:16:37 GMT

To be honest, I haven't had the patience to wait for the job to finish.
Are you suggesting this might be happening due to rate limits and it only starts calculating the date and time after the job has started?

Re: Splunk ignores date time range after a few queries

kmaron — Thu, 13 Jun 2019 14:23:31 GMT

That's my guess, yes. I have had jobs queue and when they run they're correct.

On a side note if you are having a lot of issues with jobs being queued you should look into your search quotas: https://answers.splunk.com/answers/155276/why-are-we-getting-message-waiting-for-queued-job-to-start-and-search-job-takes-5-minutes-to-run.html

Re: Splunk ignores date time range after a few queries

tomy8s — Thu, 07 Jan 2021 16:40:40 GMT

Did you ever get to the bottom of this?

We have a user who's experiencing the same problem. Whatever he seems to do, his searches are always queued with the date range set to "[01/01/1970 00:00:00.000 to 01/01/1970 01:00:00.000]".

I'd really appreciate if you have any ideas to help. 🙂

Re: Splunk ignores date time range after a few queries

tomy8s — Fri, 08 Jan 2021 09:29:10 GMT

We found the problem: The user had exceeded his disk usage quota.

And the fix: He went into his jobs and deleted a few, and then it worked.

Hope this helps anyone in future!